Bug 1897935

Summary: Crash on libsane-airscan when trying to activate scanner
Product: [Fedora] Fedora Reporter: Yann Soubeyrand <bugzilla.redhat>
Component: sane-airscanAssignee: Zdenek Dohnal <zdohnal>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 33CC: gb7658, sebastien.rohaut, zdohnal
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: sane-airscan-0.99.21-1.fc33 sane-airscan-0.99.21-1.fc32 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-28 02:03:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
scanimage-zeroconf.log none

Description Yann Soubeyrand 2020-11-15 17:11:06 UTC
Description of problem:

When launching simple-scan, I get a segmentation fault. Executing scanimage -L leads to a segfault as well. This seems to happen in libsane-airscan.

Version-Release number of selected component (if applicable):

rpm-ostree db list 404a1170140ab615fee60bb6037082648b4ae630ac716322c63fd10c93f4988a | grep sane
 libsane-airscan-0.99.18-1.fc33.x86_64
 libsane-hpaio-3.20.9-2.fc33.x86_64
 sane-airscan-0.99.18-1.fc33.x86_64
 sane-backends-1.0.31-3.fc33.x86_64
 sane-backends-drivers-cameras-1.0.31-3.fc33.x86_64
 sane-backends-drivers-scanners-1.0.31-3.fc33.x86_64
 sane-backends-libs-1.0.31-3.fc33.x86_64

How reproducible:

Execute simple-scan or scanimage -L.

Actual results:

Segmentation fault (core dumped).

Expected results:

Simple scan successfully starts and allows to scan a document. Scanimage -L lists devices.

Additional info:

coredumpctl info --no-pager 
           PID: 208016 (simple-scan)
           UID: 1000 (yann)
           GID: 1000 (yann)
        Signal: 11 (SEGV)
     Timestamp: Sun 2020-11-15 18:08:24 CET (55s ago)
  Command Line: simple-scan
    Executable: /usr/bin/simple-scan
 Control Group: /user.slice/user-1000.slice/user/app.slice/app-org.gnome.Terminal.slice/vte-spawn-6c01ba9c-a87b-46f9-94e9-fd48a0ed9eef.scope
          Unit: user
     User Unit: vte-spawn-6c01ba9c-a87b-46f9-94e9-fd48a0ed9eef.scope
         Slice: user-1000.slice
     Owner UID: 1000 (yann)
       Boot ID: 53a61dfa9b0a4aab96daf6f19ae9d8f3
    Machine ID: 5e24391d0af54b0e89a6697dcf2e3c05
      Hostname: work-laptop
       Storage: /var/lib/systemd/coredump/core.simple-scan.1000.53a61dfa9b0a4aab96daf6f19ae9d8f3.208016.1605460104000000.zst
       Message: Process 208016 (simple-scan) of user 1000 dumped core.
                
                Stack trace of thread 208026:
                #0  0x00007f6d96f4626d http_query_reset (libsane-airscan.so.1 + 0x926d)
                #1  0x00007f6d96f465d9 http_query_redirect (libsane-airscan.so.1 + 0x95d9)
                #2  0x00007f6d96f4c554 http_query_complete.lto_priv.0 (libsane-airscan.so.1 + 0xf554)
                #3  0x00007f6da439958d avahi_simple_poll_dispatch (libavahi-common.so.3 + 0x658d)
                #4  0x00007f6d96f434aa eloop_thread_func (libsane-airscan.so.1 + 0x64aa)
                #5  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #6  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208016:
                #0  0x00007f6dc4a7680f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6dc5979d1e g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa2d1e)
                #2  0x00007f6dc592641f g_main_context_iteration (libglib-2.0.so.0 + 0x4f41f)
                #3  0x00007f6dc4e033e5 g_application_run (libgio-2.0.so.0 + 0xd53e5)
                #4  0x0000563b1986d5b7 main (simple-scan + 0xd5b7)
                #5  0x00007f6dc49a81e2 __libc_start_main (libc.so.6 + 0x281e2)
                #6  0x0000563b1986d64e _start (simple-scan + 0xd64e)
                
                Stack trace of thread 208019:
                #0  0x00007f6dc4a7680f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6dc5979d1e g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa2d1e)
                #2  0x00007f6dc59286ab g_main_loop_run (libglib-2.0.so.0 + 0x516ab)
                #3  0x00007f6dc4e366b6 gdbus_shared_thread_func.lto_priv.0 (libgio-2.0.so.0 + 0x1086b6)
                #4  0x00007f6dc5955ede g_thread_proxy (libglib-2.0.so.0 + 0x7eede)
                #5  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #6  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208018:
                #0  0x00007f6dc4a7c30d syscall (libc.so.6 + 0xfc30d)
                #1  0x00007f6dc5974a38 g_cond_wait_until (libglib-2.0.so.0 + 0x9da38)
                #2  0x00007f6dc58fa341 g_async_queue_pop_intern_unlocked (libglib-2.0.so.0 + 0x23341)
                #3  0x00007f6dc58fa4c2 g_async_queue_timeout_pop (libglib-2.0.so.0 + 0x234c2)
                #4  0x00007f6dc5958ab9 g_thread_pool_thread_proxy.lto_priv.0 (libglib-2.0.so.0 + 0x81ab9)
                #5  0x00007f6dc5955ede g_thread_proxy (libglib-2.0.so.0 + 0x7eede)
                #6  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #7  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208020:
                #0  0x00007f6dc4a7680f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6dc5979d1e g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa2d1e)
                #2  0x00007f6dc592641f g_main_context_iteration (libglib-2.0.so.0 + 0x4f41f)
                #3  0x00007f6db4b5d64d dconf_gdbus_worker_thread (libdconfsettings.so + 0x664d)
                #4  0x00007f6dc5955ede g_thread_proxy (libglib-2.0.so.0 + 0x7eede)
                #5  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #6  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208017:
                #0  0x00007f6dc4a7680f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6dc5979d1e g_main_context_iterate.constprop.0 (libglib-2.0.so.0 + 0xa2d1e)
                #2  0x00007f6dc592641f g_main_context_iteration (libglib-2.0.so.0 + 0x4f41f)
                #3  0x00007f6dc5928031 glib_worker_main (libglib-2.0.so.0 + 0x51031)
                #4  0x00007f6dc5955ede g_thread_proxy (libglib-2.0.so.0 + 0x7eede)
                #5  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #6  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208024:
                #0  0x00007f6dc48f46c2 pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0 + 0xf6c2)
                #1  0x00007f6d96f6144b zeroconf_initscan_wait.lto_priv.0 (libsane-airscan.so.1 + 0x2444b)
                #2  0x00007f6d96f61566 zeroconf_device_list_get (libsane-airscan.so.1 + 0x24566)
                #3  0x00007f6d96f46742 sane_get_devices (libsane-airscan.so.1 + 0x9742)
                #4  0x00007f6dc4c978f6 sane_dll_get_devices (libsane.so.1 + 0x98f6)
                #5  0x0000563b198932f5 _scanner_scan_thread_gthread_func (simple-scan + 0x332f5)
                #6  0x00007f6dc5955ede g_thread_proxy (libglib-2.0.so.0 + 0x7eede)
                #7  0x00007f6dc48ee3f9 start_thread (libpthread.so.0 + 0x93f9)
                #8  0x00007f6dc4a81903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 208022:
                #0  0x00007f6dc4a7680f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6dc40d3d72 linux_udev_event_thread_main (libusb-1.0.so.0 + 0xbd72)
                #2  0x00007f6dc48ee3f9 start_thread (libpthread.so.

coredumpctl info
           PID: 207674 (scanimage)
           UID: 1000 (yann)
           GID: 1000 (yann)
        Signal: 11 (SEGV)
     Timestamp: Sun 2020-11-15 18:06:04 CET (1min 38s ago)
  Command Line: scanimage -L
    Executable: /usr/bin/scanimage
 Control Group: /user.slice/user-1000.slice/user/app.slice/app-org.gnome.Terminal.slice/vte-spawn-6c01ba9c-a87b-46f9-94e9-fd48a0ed9eef.scope
          Unit: user
     User Unit: vte-spawn-6c01ba9c-a87b-46f9-94e9-fd48a0ed9eef.scope
         Slice: user-1000.slice
     Owner UID: 1000 (yann)
       Boot ID: 53a61dfa9b0a4aab96daf6f19ae9d8f3
    Machine ID: 5e24391d0af54b0e89a6697dcf2e3c05
      Hostname: work-laptop
       Storage: /var/lib/systemd/coredump/core.scanimage.1000.53a61dfa9b0a4aab96daf6f19ae9d8f3.207674.1605459964000000.zst
       Message: Process 207674 (scanimage) of user 1000 dumped core.
                
                Stack trace of thread 207678:
                #0  0x00007f6f9b95426d http_query_reset (libsane-airscan.so.1 + 0x926d)
                #1  0x00007f6f9b9545d9 http_query_redirect (libsane-airscan.so.1 + 0x95d9)
                #2  0x00007f6f9b95a554 http_query_complete.lto_priv.0 (libsane-airscan.so.1 + 0xf554)
                #3  0x00007f6f9d1ae58d avahi_simple_poll_dispatch (libavahi-common.so.3 + 0x658d)
                #4  0x00007f6f9b9514aa eloop_thread_func (libsane-airscan.so.1 + 0x64aa)
                #5  0x00007f6f9ef7f3f9 start_thread (libpthread.so.0 + 0x93f9)
                #6  0x00007f6f9f3d3903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 207675:
                #0  0x00007f6f9f3c880f __poll (libc.so.6 + 0xf680f)
                #1  0x00007f6f9f2c1d72 linux_udev_event_thread_main (libusb-1.0.so.0 + 0xbd72)
                #2  0x00007f6f9ef7f3f9 start_thread (libpthread.so.0 + 0x93f9)
                #3  0x00007f6f9f3d3903 __clone (libc.so.6 + 0x101903)
                
                Stack trace of thread 207674:
                #0  0x00007f6f9ef856c2 pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0 + 0xf6c2)
                #1  0x00007f6f9b96f44b zeroconf_initscan_wait.lto_priv.0 (libsane-airscan.so.1 + 0x2444b)
                #2  0x00007f6f9b96f566 zeroconf_device_list_get (libsane-airscan.so.1 + 0x24566)
                #3  0x00007f6f9b954742 sane_get_devices (libsane-airscan.so.1 + 0x9742)
                #4  0x00007f6f9f5538f6 sane_dll_get_devices (libsane.so.1 + 0x98f6)
                #5  0x000055b59404e6a5 main (scanimage + 0x26a5)
                #6  0x00007f6f9f2fa1e2 __libc_start_main (libc.so.6 + 0x281e2)
                #7  0x000055b5940511ee _start (scanimage + 0x51ee)

Comment 1 Yann Soubeyrand 2020-11-15 17:17:44 UTC
Created attachment 1729593 [details]
scanimage-zeroconf.log

Comment 2 Sébastien 2020-11-15 18:04:57 UTC
Dear,

I had the exact same issue, with my HP ENVY Photo 6232. code dump on any tool that uses libsane-airscan.

So, I cloned https://github.com/alexpevzner/sane-airscan, today, I build from sources and I manually replaced the 0.99.18 library coming from FC33 with the new one.

And, now...

# scanimage -L
device `airscan:e1:HP ENVY Photo 6200 series [7351AD] (4)' is a eSCL HP ENVY Photo 6200 series [7351AD] (4) eSCL (192.168.1.82)

It works ! And I can scan again.

Perhaps it's time to upgrade the FC33 package ?

Comment 3 Zdenek Dohnal 2020-11-18 05:56:25 UTC
Hi Yann and Sebastien,

thank you for reporting the issue and checking the newest upstream master branch works!

I totally overlooked the email about new version :( sorry for that.

I created a scratch build for now with the newest version - please test https://koji.fedoraproject.org/koji/taskinfo?taskID=55783753 and let me know if it works for you.

At the same time, I'll update sane-airscan to version 0.99.19 in https://bugzilla.redhat.com/show_bug.cgi?id=1890866 .

If the newest version doesn't work for you but current sane-airscan master does, I'll contact upstream for making a new release, so please let me know if the current upstream release works for you.

Comment 4 Zdenek Dohnal 2020-11-23 06:23:14 UTC
Upstream released version 0.99.20 last Friday, so if the master branch from 2020-11-15 contained the fix, version 0.99.20 will contain the fix for sure.

I'm starting to build the 0.99.20 right now, appending this ticket to the update.

Comment 5 Fedora Update System 2020-11-23 06:34:42 UTC
FEDORA-2020-d429daea77 has been submitted as an update to Fedora 33. https://bodhi.fedoraproject.org/updates/FEDORA-2020-d429daea77

Comment 6 Fedora Update System 2020-11-23 06:46:40 UTC
FEDORA-2020-a78800c08a has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-a78800c08a

Comment 7 Fedora Update System 2020-11-24 01:26:00 UTC
FEDORA-2020-d429daea77 has been pushed to the Fedora 33 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-d429daea77`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-d429daea77

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2020-11-24 02:20:27 UTC
FEDORA-2020-a78800c08a has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-a78800c08a`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-a78800c08a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Yann Soubeyrand 2020-11-24 06:17:44 UTC
Hi Zdenek,

I confirm the bug is fixed with this new package, thanks!

Comment 10 Fedora Update System 2020-11-25 01:19:36 UTC
FEDORA-2020-65a981c297 has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-65a981c297`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-65a981c297

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2020-11-25 02:11:44 UTC
FEDORA-2020-828f9e06f9 has been pushed to the Fedora 33 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-828f9e06f9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-828f9e06f9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Zdenek Dohnal 2020-11-25 12:10:14 UTC
*** Bug 1889703 has been marked as a duplicate of this bug. ***

Comment 13 Fedora Update System 2020-11-28 02:03:50 UTC
FEDORA-2020-828f9e06f9 has been pushed to the Fedora 33 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 14 Fedora Update System 2020-12-03 01:41:22 UTC
FEDORA-2020-65a981c297 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.